[IBM]

>Nobody said that Apple no longer retains control of the keys. The point is that the Chinese government has access to Apple user data and Apple is complicit.

The Chinese government has the exact same access to Apple user data as before, which is through Apple. Who controls the keys is what matters.

[bduerst]

>The Chinese government has the exact same access to Apple user data as before, which is through Apple.

No, the Chinese government now owns the servers with the key storage. They now have access to all the keys and user data at rest.

If the Chinese government is accessing all the user data because they requested Apple to put the user keys on their now-state-owned servers, then why does it matter if Apple controls the keys? You're still splitting hairs.

[IBM]

>No, the Chinese government now owns the servers with the key storage. They now have access to all the keys and user data.

>If the Chinese government is accessing all the user data because they requested Apple to put the user keys on their now-state-owned servers, then why does it matter if Apple controls the keys? You're still splitting hairs.

Apple said literally the opposite of this to Reuters and in this statement to 9to5Mac [1]:

>Last year, we announced that Guizhou on the Cloud Big Data (GCBD) would become the operator of iCloud in China. As we said at the time, we’re committed to continuously improving the user experience, and our partnership with GCBD will allow us improve the speed and reliability of our iCloud services products while also complying with newly passed regulations that cloud services be operated by Chinese companies. Because of our commitment to transparency, there will be a series of customer communications over the course of the next seven weeks to make sure customers are well informed of the coming changes. Apple has strong data privacy and security protections in place and no backdoors will be created into any of our systems.

You seem to think there's some material difference by storing the keys or data in China. There isn't. China's power over Apple comes from the fact that they can block their access to operate in China. It's not technical or legal. Chinese iCloud data was just as vulnerable to requests from the Chinese government when it was stored in the US.

[1] https://9to5mac.com/2018/01/10/apple-will-begin-storing-chin...

[fauigerzigerk]

You are wrong. Apple merely said "no backdoors will be created into any of our systems".

And no backdoors into any of Apple's systems are necessary because a government-owned company will be operating iCloud, including the keystore.

Apple's terms of service make this very clear:

"You understand and agree that Apple and GCBD will have access to all data that you store on this service"

https://www.apple.com/legal/internet-services/icloud/en/gcbd...

[IBM]

Apple told Reuters that is not what's happening:

>Apple says the joint venture does not mean that China has any kind of “backdoor” into user data and that Apple alone – not its Chinese partner – will control the encryption keys.

https://www.reuters.com/article/us-china-apple-icloud-insigh...

[fauigerzigerk]

So Apple is saying one thing to the media and another thing in their legally binding customer agreement.

Someone should ask Apple which one it is, because these statements seem completely irreconcilable to me.

[bduerst]

Yep - saying there are "no backdoors" isn't the same as giving front door access.